« Volver al listado

CVE-2008-6560

Estado: ModificadaAlta (7.8)—

Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines. NOTE: it is not clear whether this issue crosses privilege boundaries in realistic uses of the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Cman

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-6560",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-31T14:09:53.390",
  "references": [
    {
      "url": "http://git.fedorahosted.org/git/cluster.git?p=cluster.git%3Ba=commitdiff%3Bh=67fee9128e54c6c3fc3eae306b5b501f3029c3be",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-875-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=468966",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49832",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.fedorahosted.org/git/cluster.git?p=cluster.git%3Ba=commitdiff%3Bh=67fee9128e54c6c3fc3eae306b5b501f3029c3be",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-875-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=468966",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49832",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines.  NOTE: it is not clear whether this issue crosses privilege boundaries in realistic uses of the product."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer en CMAN - The Cluster Manager versiones anteriores a v2.03.09-1 en Fedora 9 y Red Hat Enterprise Linux (RHEL) 5 permite a atacantes provocar una denegación de servicio (consumo de CPU y consumo de memoria) a través de un fichero cluster.conf con muchas líneas. \r\nNOTA: no está claro si este problema cruza fronteras de privilegios en usuarios reales del producto."
    }
  ],
  "lastModified": "2026-06-16T23:02:27.430",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:cman:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5280A55-F6CF-4D35-B9D4-A76321EC591A",
              "versionEndIncluding": "2.03.08-1"
            },
            {
              "criteria": "cpe:2.3:a:redhat:cman:2.03.03-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F12B9C5F-29A5-4B40-89E2-CD32477C087F"
            },
            {
              "criteria": "cpe:2.3:a:redhat:cman:2.03.04-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06ABB244-870D-4D5F-81FA-0D8D133A1B2D"
            },
            {
              "criteria": "cpe:2.3:a:redhat:cman:2.03.05-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C31DAF4D-B7BB-43CE-87EC-33062475AF0C"
            },
            {
              "criteria": "cpe:2.3:a:redhat:cman:2.03.07-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25AD771F-0B14-4EC9-A425-3E49BE177402"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:fedora:9:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D32A30CD-EA21-4AA6-868F-3448AA50B70D"
            },
            {
              "criteria": "cpe:2.3:o:redhat:linux:5.0:*:enterprise:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A00F5B01-0C61-48A6-BE78-1981CA6C09FD"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "vendorComments": [
    {
      "comment": "Red Hat does not consider this to be a security issue. The misbehaviour of CMAN is triggered by corrupted / specially crafted cluster.conf configuration file. Ability to edit this file is restricted to system administrator, therefore no privilege boundary is crossed.",
      "lastModified": "2009-08-04T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}